Field of the Invention
The present invention relates to a technique for determining a computer virus infection route.
Description of the Related Art
Computer viruses have become more and more sophisticated. In order to prevent infection by a computer virus, it is important to determine a computer virus infection route. Assume here that an operation for tracing, when a virus is found, the place that the virus comes from is referred to as backtrack, back-trace or trace-back, and an operation for estimating terminals to which this virus has already spread is referred to as forward track.
Patent reference 1 discloses an invention relating to backtrack. According to Patent reference 1, a central device estimates, upon detection of a virus from a file transmitted from a terminal device via the central device, a virus infection period based on the time and date on which a vaccine was registered, the time and date on which this file was last transmitted, and the time and date on which this file is transmitted this time. Particularly, if the time and date on which this file was last transmitted is after the time and date on which the vaccine was registered, it will be determined that the infection route is via a device other than the central device, and if the time and date on which this file was last transmitted is before the time and date on which the vaccine was registered, it will be determined that the infection route is via the central device or another ISP.
Patent reference 2 discloses an invention relating to forward track. According to Patent reference 2, a damage range estimation system is disclosed that determines, when a virus has been detected from a file of one client terminal, other client terminals that has ever accessed this file in the past, as a terminal that may be infected by the virus.